The original research checked the Turn / NAI / DAA opt out. According to Mayer, it does't respawn. This part of Turn's response is a lie.

So what you're saying is that we need everyone on the planet to install an app that automatically accesses Turn's website every few seconds ... just to be sure that they know we don't want tracking!

;0)

They claim the opt-out is stored on their servers and associated with the uid (implying that the optout=1 cookie isn't necessary)

It's convenient for them that their server-side opt-out code cannot be audited. It would have been easier for them to just set an anonymous, client-side opt-out cookie.

A client-side cookie is not sufficient, you'd have to set it in every browser you ever use. Practically speaking it needs to be server-side, but should be (but never would be) opt-in rather than opt-out.

The other option is respecting DNT, but that is never going to happen as a default behaviour for all companies.

Not just missing a cookie. The original post has screenshots of status checkers showing no opt out.

Splitting hairs, but it's not exactly a default. It's a preselected option. The user gets some notice and has to accept.

OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide.

If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.

Yeah, that was main reason why I wanted to share his original post – the EFF (or ProPublica) stories aren't bad but he's done a great job writing about many things of interest to the HN community.

Didn't see this yesterday, and I'm sorry we didn't, because we would have switched out the URL. HN prefers original sources, and it's always nicer to give credit (and traffic) to the original creator or researcher.

Unfortunately, it's too late to make a difference now, so we'll just leave things as they were. However: if you (or anyone) notice something like this in the future, the best way to alert us is to email hn@ycombinator.com. We can't read all the threads but we do see all those emails, and usually pretty quickly.